Forensic acquisition of AWS instance

Let us jump right into the details of collecting forensic artifacts in a secure and forensically sound manner. We will assume that an organization received alerts for ransomware deployment on an Elastic Compute Cloud (EC2) instance. As a result, this instance was stopped. Forensic investigators would need to pull forensic artifacts out of the EC2 instance safely.

Any disks associated with an EC2 instance are referred to as volumes by AWS. To collect artifacts, investigators have to follow a specific sequence of steps. Firstly, investigators must record the infected instance’s instance ID (unique identifier).

In this case, the infected instance name is CF2 and it has the instance ID i-00229ce2dd123a2e6.

Step 1 – creating EC2 volume snapshots

We will refer to these EC2 instances by their instance ID for the following steps:

1. Investigators must note storage volumes associated with i-00229ce2dd123a2e6 (CF2) and the volume...